How to root and enable Google Pay on a CustomROM (Lineage) (SafetyNet bypass)

lineage-root-and-enable-google-pay.txt

How to root and enable Google Wallet on a CustomROM (Lineage). You have to do this after each system update

Preparations
- install Magisk app https://github.com/topjohnwu/Magisk
- install rootbeer (a simple root checking app) https://github.com/scottyab/rootbeer
- install Termux (use the F-Droid version, only needed for testing) https://f-droid.org/en/packages/com.termux/

1) Update Android via OTA-Updater
    - Android -> Settings-> System -> Advanced -> Updater
    - search for update, DOWNLOAD the image, click INSTALL
    - then the smartphone will reboot to custom recovery (TWRP)
    - it asks for full disk encryption password. Then the Update will be installed automatically.
    - reboot to system
2) Download the same image to your laptop
    - https://download.lineageos.org/jason in my case
    - unzip lineage-18.1-20210825-nightly-jason-signed.zip
    - then, there is a boot.img file
3) Patch boot.img
    - copy boot.img to sdcard
        kmille@linbox:tmp adb push boot.img /sdcard
        boot.img: 1 file pushed, 0 skipped. 30.2 MB/s (14938112 bytes in 0.472s)
    - open Magisk app
        - click on the Install button (the upper one, right beside the 'Magisk')
        - keep the checkbox 'Preserve force-encryption' enabled
        - click Next
        - 'select and patch a file': choose your boot.img
        - click 'Let's go' and check for errors
4) copy the patched boot image back to the laptop
        kmille@linbox:tmp adb pull /sdcard/Download/magisk_patched-23000_aXmHd.img .
        /sdcard/Download/magisk_patched-23000_aXmHd.img: 1 file pulled, 0 skipped. 24.6 MB/s (15249408 bytes in 0.592s)
5) boot into bootloader
        kmille@linbox: adb reboot bootloader
6) you should see a device using the fastboot command
        kmille@linbox: fastboot devices
        deadbeef        fastboot
7) flash patched boot.img
        kmille@linbox:tmp fastboot flash boot magisk_patched-23000_aXmHd.img
        Sending 'boot' (14892 KB)                          OKAY [  0.449s]
        Writing 'boot'                                     OKAY [  0.000s]
        Finished. Total time: 0.492s
8) reboot to system
        kmille@linbox:tmp fastboot reboot
        Rebooting                                          OKAY [  0.000s]
        Finished. Total time: 0.050s
8) Testing root access
    - open Termux app. Enter su. Now you should be asked if you want to allow Termux app root access
    - open RootBeer app. It should show many red flags (YES, we are root and don't hide it right now)
9) Rename Magisk app
    - open Magisk app -> Settings -> Hide the Magisk app (I called it Setings)
    - a shortcut to the home screen
    - now the Magisk app has renamed to a random name (open the app and check the Package name)
    - listing all apps, I now have an app called Setings (which is our new Magisk)
    - there is also a 'Restore the Magisk app' button in the Settings
10) Hiding root
    - open Magisk app (the renamed one) -> Settings -> enable the Zygisk slider
    - at the bottom, in the middle, there are four icons, click the second from the left (looks like a shield?)
    - click on 'configure DenyList'
    - set checkboxes for
        - GooglePay (walletnfcrel and walletnfcrel:primes_lifeboat)
        - Google Play services (com.google.android.gms and com.google.android.gmx.unstable)
        - RootBeer Sample
    - open the RootBeer app (you have to restart it if it's already loaded) -> everything should be green now
        - if 'Dangerous Props' is still red
            - it's possible that you need to install the 'MagiskHide Props Config' Module (I'm not quite sure if you really need it)
            - open Magisk app -> at the bottom, click the most right button -> you will see the installed modules
                 - install/update the 'MagiskHide Props Config' module
    - reboot your phone and check
        - [x] root still works
        - [x] RootBeer ist still green
        - [ ] Google Wallet still doesn't work: if you open the app -> 'Your device doesn't meet the security standards...'
11) Special care for Goolge Pay
    - enable airplane mode
    - clear data: Android -> Settings -> Apps
        - Google Wallet: clear storage
        - Google Play services: clear cache
    - reboot the device
    - disable airplane mode

At this point, Google Wallet still complains about "the phone does not meet the security requirements". The thing here is: wait. Just wait. And be patient.
I've waited some days and then suddenly it just worked: "Your phone meets security requirements" and "Hold to reader" (maybe you have to re-add your card again).
This is super strange and I can't explain it. But I've experienced it several times in the past. Unfortunately, you have to carry out the whole procedure after each system update.
And I remember, that last time after the system update it took also some days until a notification appeared: "Your phone does not meet security requirements" (which makes sense, but it also took some days in this case too).


# Resources
- https://topjohnwu.github.io/Magisk/install.html checkout the official Magic docs!
- https://forum.xda-developers.com/t/working-magisk-with-google-pay-as-of-gms-17-1-22-on-pie.3929950/page-9#post-79643248